This vulnerability affects Oracle WebCenter Portal component Composer in versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the portal, resulting in unauthorized creation, deletion, or modification of critical or accessible data, unauthorized read access to some data, and partial denial of service. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, scope change, low confidentiality impact, high integrity impact, and low availability impact. The vulnerability is included in Oracle's August 2026 Critical Security Patch Update, which contains numerous patches across Oracle products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all accessible data in Oracle WebCenter Portal, unauthorized read access to a subset of accessible data, and partial denial of service of the portal. The vulnerability affects confidentiality, integrity, and availability with a high severity rating (CVSS 7.7). Additionally, attacks may impact other Oracle products due to scope change.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. No indication is given that the vulnerability is already mitigated or requires no action. Patch availability details are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. Users should remain on actively supported versions and apply security patches without delay.